High severity · published Oct 17, 2024
CVE-2024-5429
Logo Slider < 4.1.0 - Contributor+ Stored XSS
7.6
CVSS
0.5%
EPSS
No
On KEV
Description
The Logo Slider WordPress plugin before 4.1.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LS
Logo Slider ·
before 4.1.0 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5429
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5429
Exploit
https://wpscan.com/vulnerability/ddb76c88-aeca-42df-830e-abffd29f1141/
More from Logo Slider
6.1
CVE-2025-13153
Logo Slider < 4.9.0 - Contributor+ Stored XSS
5.4
CVE-2024-12308
Logo Slider < 4.6.0 - Contributor+ Stored XSS
5.4
CVE-2024-10896
Logo Slider < 4.5.0 - Contributor+ Stored XSS
5.4
CVE-2024-10473
Logo Slider < 4.5.0 - Author+ Stored XSS
5.4
CVE-2024-3288
Logo Slider < 4.0.0 - Contributor+ Stored XSS